CN105808256B - It is a kind of to construct the method and system that legal storehouse return value bypasses function call detection - Google Patents

Abstract

The invention discloses a method for constructing a legal stack return value to bypass function call detection, comprising: constructing any two consecutive assembly instruction sequences in the code segment of the d3d9. pop ebp, retn addresses, where the number of times the address is pushed is greater than or equal to the number of stack detection calls; after pushing the above address into the stack for many times, construct the parameters required by the system function CreateDeviceEx and push them into the stack, and then go to the stack After pressing the above address again, jump to the system function CreateDeviceEx. By constructing a recursive call to push the address of any two consecutive assembly instruction sequences pop ebp, retn in the code segment of the d3d9. The legal address, so that when the game developer checks the caller of the CreateDeviceEx function, it can pass the legality verification, so as to ensure the normal progress of the live broadcast.

Description

A method and system for constructing a legal stack return value to bypass function call detection

technical field

The invention belongs to the technical field of computer development, and more specifically relates to a method and system for constructing a legal stack return value to bypass function call detection.

Background technique

At present, the live broadcast software can preview the live broadcast content during the live broadcast. The display content of the live broadcast is obtained by injecting a dynamic link library into the game process. The injected dynamic link library will hook the Present function of d3d9.dll in the process. To obtain the display content of the graphics card, in order to obtain the address of the Present function, you need to obtain the pointer of IDirect3DDevice9Ex first, and obtain the function address from the pointer, and the pointer can be obtained by calling the CreateDeviceEx function. However, because many "plug-ins" currently call this function to achieve certain "plug-in" functions, game developers will check the caller who calls this function. If it is not called by the game itself, it will be judged that the "plug-in" is calling , thereby punishing. For how to detect who called a certain function, you can use the function call mechanism of intel x86, which will use the extended base pointer register (extended basepointer, EBP) and the stack top register (Extended Stack Pointer, ESP) when calling the function. Store the bottom address and top address of the current stack. The bottom address of the stack stores the return address of calling this function. Therefore, by continuously looking back at the EBP register to obtain the return address of the function call, the entire call chain for calling this function can be obtained, thereby distinguishing whether it is a legal call address.

Contents of the invention

Aiming at the above defects or improvement needs of the prior art, the present invention provides a method for bypassing stack detection. This invention uses a carefully constructed assembly code to cover up the real call by continuously pushing legal addresses into the stack. .

In order to achieve the above object, according to one aspect of the present invention, a method for constructing a legal stack return value to bypass function call detection is provided, including: constructing a code segment that recursively calls the d3d9.dll module that is repeatedly pushed into the stack The address of any two consecutive assembly instruction sequences pop ebp, retn in which the number of times the address is pushed is greater than or equal to the number of stack detection calls; after pushing the above address into the stack for many times, the construction system function CreateDeviceEx needs parameters and push them into the stack, and push the above addresses into the stack again, then jump to the system function CreateDeviceEx.

In one embodiment of the present invention, the method of obtaining the address pushed into the stack is: in the code segment of the d3d9. The hexadecimal system corresponding to the assembly instruction sequence pop ebp, retn.

In one embodiment of the present invention, the method for constructing a legal stack return value to bypass function call detection is specifically:

initialize i = n;

Void func(void)

{

Push the address of any two consecutive assembly instruction sequences pop ebp, retn in the code segment of the d3d9.dll module of the process into the stack;

Decrement the value of i by one;

if: i>=0

jump to func();

otherwise

Push the parameters required by the construction system function CreateDeviceEx into the stack, and push the above address into the stack again, then jump to the system function CreateDeviceEx;

}

Among them, n is the number of layers called by the stack detection.

In one embodiment of the present invention, the method for constructing a legal stack return value to bypass function call detection is specifically:

init i=0;

Void func(void)

{

Push the address of any two consecutive assembly instruction sequences pop ebp, retn in the code segment of the d3d9.dll module of the process into the stack;

Decrement the value of i by one;

if: i<=n

jump to func();

otherwise

Push the parameters required by the construction system function CreateDeviceEx into the stack, and push the above address into the stack again, then jump to the system function CreateDeviceEx;

}

Among them, n is the number of layers called by the stack detection.

In an embodiment of the present invention, the number of times the recursive call pushes addresses into the stack is greater than or equal to 5.

According to another aspect of the present invention, there is also provided a system for constructing a legal stack return value to bypass function call detection, including a recursive module and a recursive jump-out module, wherein:

The recursive module is used to construct the addresses of any two consecutive assembly instruction sequences pop ebp and retn in the code segment of the d3d9. Or equal to the number of layers of the stack detection call;

The recursive jump-out module is used to construct the parameters needed by the system function CreateDeviceEx and push the parameters into the stack after the recursive module pushes the above-mentioned address in the stack multiple times, and after pushing the above-mentioned address in the stack again, jump to System function CreateDeviceEx.

In one embodiment of the present invention, the method of obtaining the address pushed into the stack is: in the code segment of the d3d9. The hexadecimal system corresponding to the assembly instruction sequence pop ebp, retn.

In one embodiment of the present invention, the specific implementation of the system is:

initialize i = n;

Void func(void)

{

Push the address of any two consecutive assembly instruction sequences pop ebp, retn in the code segment of the d3d9.dll module of the process into the stack;

Decrement the value of i by one;

if: i>=0

jump to func();

otherwise

Push the parameters required by the construction system function CreateDeviceEx into the stack, and push the above address into the stack again, then jump to the system function CreateDeviceEx;

}

Among them, n is the number of layers called by the stack detection.

In one embodiment of the present invention, the specific implementation of the system is:

init i=0;

Void func(void)

{

Push the address of any two consecutive assembly instruction sequences pop ebp, retn in the code segment of the d3d9.dll module of the process into the stack;

Decrement the value of i by one;

if: i<=n

jump to func();

otherwise

Push the parameters required by the construction system function CreateDeviceEx into the stack, and push the above address into the stack again, then jump to the system function CreateDeviceEx;

}

Among them, n is the number of layers called by the stack detection.

In an embodiment of the present invention, the number of times the recursive call pushes addresses into the stack is greater than or equal to 5.

Generally speaking, compared with the prior art, the above technical scheme conceived by the present invention, by constructing a recursive call, any two consecutive assembly instructions in the code segment of the d3d9. Sequence the address of pop ebp, retn, so that the legal address exceeding the number of stack detection call layers is pushed into the stack, so that the game developer can pass the legality verification when the caller who calls the CreateDeviceEx function is checked, so as to ensure the normality of the live broadcast conduct.

Description of drawings

Fig. 1 is a schematic diagram of a method for constructing a legal stack return value to bypass function call detection in the present invention;

Fig. 2 is a system structure diagram for constructing a legal stack return value to bypass function call detection in the present invention.

detailed description

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not constitute a conflict with each other.

As shown in Figure 1, the present invention provides a method for constructing a legal stack return value to bypass function call detection, including: constructing any one of the code segments of the d3d9. The addresses of two consecutive assembly instruction sequences pop ebp, retn, and the number of times the address is pushed is greater than or equal to the number of layers called by the stack detection; after pushing the above address into the stack for many times, construct the parameters required by the system function CreateDeviceEx and press After pushing the above address into the stack again, jump to the system function CreateDeviceEx.

In the embodiment of the present invention, the specific implementation of the technical solution of the present invention is as follows:

Step 1: Find the addresses of any two consecutive assembly instruction sequences popebp and retn in the code segment of the d3d9.dll module of the process.

In the code segment of the d3d9.dll module of the process, search for the assembly instruction sequence pop ebp, and the hexadecimal value corresponding to retn is 0x5D, 0xC3, so you only need to search for consecutive instructions with the value 0x5D, 0xC3 in the code segment of the d3d9.dll module address.

For the above two assembly instruction sequences pop ebp, retn, where pop ebp is used to pop the value in the stack to the register EBP; retn is a return instruction, used to pop the return address from the stack. The two assembly instructions can realize returning from a piece of code to the next instruction address of the instruction calling the code. If the two pieces of assembly code are directly written in the function designed by the developer, the calling point can be traced back when the stack is retrieved, so it will be judged as an illegal call by the system. If the addresses of the two assembly codes are obtained from the legal module of d3d9.dll, it will have the effect of hiding the real call address, so that it will not be judged as an illegal call. In the d3d9.dll module, these 2 instructions can be obtained from the end of the function easily, so the present invention is to find 2 consecutive instructions from the code segment of the d3d9.dll dynamic link library to be (pop ebp ; retn) (finding method is by comparing the hexadecimal value of the assembly instruction) address. Executing this assembly code can return to the upper function call, so by using this address, stack detection can be bypassed.

Since it takes a certain amount of time to find the address of the assembly instruction sequence pop ebp, retn in the code segment of the d3d9. Press that address. Of course, it is also possible to do a lookup every time the address needs to be pushed into the stack, but it will reduce the operating efficiency of the system because of increased lookup time.

Step 2: Construct a function to call the system CreateDeviceEx

This function is used to construct the parameters of the system CreateDeviceEx function, then push the memory address found in step 1 into the stack, and jump to the system function CreateDeviceEx.

The pseudo code is as follows:

{

The parameters required by the constructor system function CreateDeviceEx are pushed onto the stack

Push the memory address found in step 1 onto the stack

Jump to the system function CreateDeviceEx

}

For example, an assembly function nakedCallCreateDeviceEx can be constructed, which can realize the functions of constructing the parameters of the system CreateDeviceEx function, then pushing the memory address found in step 1 into the stack, and jumping to the system function CreateDeviceEx.

Step 3: Construct a recursive call to construct a legal address on the stack and call the function of step 2

The function of this function is to construct the recursive call to push the address obtained in step 1 into the stack, and the recursive exit is to call the function in step 2. In this way, many legal call addresses are constructed in the stack. The number of recursions needs to find the number of detection layers of the game, for example, if it is n layers, then the legal calling address of the construction only needs to be greater than or equal to n+1 layers.

The pseudocode is implemented using assembly code as follows:

initialize i=n

Void func(void)

{

Push the memory address found in step 1 onto the stack

decrement the value of i by one

if: i>=0

Jump to func() (implement recursive calls)

otherwise

Jump to the function of step 2

}

Of course, it can also be another way of implementation, which is:

The specific implementation of the system is as follows:

init i=0;

Void func(void)

{

Push the address of any two consecutive assembly instruction sequences pop ebp, retn in the code segment of the d3d9.dll module of the process into the stack;

Decrement the value of i by one;

if: i<=n

jump to func();

otherwise

Push the parameters required by the construction system function CreateDeviceEx into the stack, and push the above address into the stack again, then jump to the system function CreateDeviceEx;

}

For example, a piece of assembly code function nakedCallCreateDeviceExPrev can be constructed. The function of this function is to set a loop and call this function continuously, which will generate a long call chain. The exit of the loop is to call the function mentioned in step 2. Since stack detection generally only detects 5-layer calls, the above method can generate a call chain of any layer through a loop, and the return address of each layer of calls is a legal address.

As shown in Figure 2, the present invention also provides a system for constructing a legal stack return value to bypass function call detection, including a recursive module and a recursive jump-out module, wherein:

The recursive module is used to construct the addresses of any two consecutive assembly instruction sequences pop ebp and retn in the code segment of the d3d9. Or equal to the number of layers of the stack detection call;

The recursive jump-out module is used to construct the parameters needed by the system function CreateDeviceEx and push the parameters into the stack after the recursive module pushes the above-mentioned address in the stack multiple times, and after pushing the above-mentioned address in the stack again, jump to System function CreateDeviceEx.

Those skilled in the art can easily understand that the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention, All should be included within the protection scope of the present invention.

Claims (4)

1. A method for constructing a legal stack return value to bypass function call detection, characterized in that it comprises: constructing any two consecutive compilations in the code segment of the d3d9. The address of the instruction sequence popebp, retn, where the number of times the address is pushed is greater than or equal to the number of stack detection calls; after pushing the above address into the stack for many times, the parameters required by the system function CreateDeviceEx are constructed and pushed into the stack, and then After pushing the above address into the stack again, jump to the system function CreateDeviceEx; the specific implementation steps are: (1) Find the address of any two consecutive assembly instruction sequences pop ebp, retn in the code segment of the d3d9.dll module of the process, wherein, search for the assembly instruction sequence pop ebp, retn in the code segment of the d3d9.dll module of the process The hexadecimal value corresponding to retn is 0x5D, 0xC3, that is, in the code segment of the d3d9.dll module, search for the address of the instruction with a continuous value of 0x5D, 0xC3, and pop ebp is used to pop the value in the stack to the register EBP; retn is a return instruction, used to pop the return address from the stack; (2) construct the function of calling system function CreateDeviceEx, this function is used for the parameter of constructing system function CreateDeviceEx, pushes the memory address found in step (1) into the stack then, and jumps to system function CreateDeviceEx; (3) Construct a recursive calling function, which is used to construct the recursive calling stack to push the address obtained in step (1), and the recursive exit is the function of calling step (2), wherein the steps ( The function in 2) is a function to call the system function CreateDeviceEx. 2. The method for constructing a legal stack return value to bypass function call detection according to claim 1, wherein the number of times the recursive call pushes an address into the stack is greater than or equal to 5. 3. A system for constructing a legal stack return value to bypass function call detection, characterized in that it comprises: a first module, a second module and a third module; The first module is used to find the address of any two consecutive assembly instruction sequences pop ebp, retn in the code segment of the d3d9.dll module of the process, wherein the assembly is searched in the code segment of the d3d9.dll module of the process The hexadecimal system corresponding to the instruction sequence popebp, retn is 0x5D, 0xC3, that is, the code segment of the d3d9.dll module searches for the addresses of consecutive instructions with the value 0x5D, 0xC3, popebp is used to pop the value in the stack to the register EBP middle; retn is a return instruction, which is used to pop the return address from the stack; The second module is used to construct a function for calling the system function CreateDeviceEx, which is used to construct the parameters of the system function CreateDeviceEx, then pushes the memory address found by the first module into the stack, and jumps to the system function CreateDeviceEx; The third module is used to construct a recursive call function, the recursive call function is used to construct the recursive call to push the address obtained in the first module into the stack, and the recursive exit is to call the address in the second module function, wherein the function in the second module is a function that calls the system function CreateDeviceEx. 4. The system for constructing a legal stack return value to bypass function call detection according to claim 3, wherein the number of times the recursive call pushes an address into the stack is greater than or equal to 5.